csm chair alun michael mp speaks to cyber security summit

Cyber Security Summit 2010 Conference

  Coordinating Activity at a National and International Level in response to Online Threats   Rt. Hon Alun Michael MP

Thursday 11^th of November 2010

Queen Elizabeth II Conference Centre

   

I’m pleased to say that I’m not going to disagree with what I’ve heard so far,  but I’m going to come at the subject from a different direction.

Can I start with a bit of audience participation ?

Hands up those of you who think that IT and Internet-related issues are too important to be delegated by the Chief Executive to the ITO ?

Hm – that’s a disturbingly low proportion.

And that the same applies to Permanent Secretaries ?

Even lower ! That’s worrying only a week after the Department for Business hosted an excellent event aimed at persuading CEOs and policy makers that IT and Internet-related issues are too important for the CEO not to be personally and strategically engaged.

Right then, now can I have hands up please : How many of you are regular listeners to “Thought for the Day” on BBC Radio 4’s Today Programme?

Not that many – so how many of you heard Thought for the Day yesterday ?

Right ...... so hardly any of you heard an excellent contribution by James Jones, the Bishop of Liverpool yesterday. So let me put that right.

The Bishop described the Internet with what many might call impressive accuracy as “a simmering cauldron of virtue and vice”.

He added that the online world, “like the human heart, is uncensored……”  

He added that “.......... the good and bad jostle with each other in the ether”.

You may not have thought of the internet as a battle ground between the angels of the better side of our nature and our baser demonic impulses – but the Bishop makes a very important point. 

The internet is above all a creature of mankind’s own making – it’s a “virtual” mirror of our own strengths, successes, weaknesses and failings.

 So the challenge of governing the internet - the challenge of maximising its use for good and minimising its use for harm - is precisely the same challenge that has faced mankind since the dawn of time.

How should we regulate the Internet ? It’s precisely the same question that faced every law-giver from Moses to our Victorian forefathers and to today’s Parliamentarians. How – in any set of circumstances – do we encourage the best of human behaviour and restrain the worst aspects of human behaviour.

The speed and reach and rapid evolution of Internet applications makes this technically challenging, but that’s not the main issue.

The technology is central as is a high degree of systematic and sophisticated protection – but the fact is that if we focus exclusively on technology to produce all the solutions to cyber attacks and cyber crime we will fail. You cannot safely ignore the human motivations and relationships or the ambitions and incentives which determine how people behave.

If you do so you risk critically undermining our chances of success.

At the Parliament and Internet Day last year we heard from the young people - brought there by the excellent charity Childnet - and they summarised their ambition :  “to be free to go anywhere on the internet without hindrance or restraint .......   and to know that we’re safe”.

So the aspirations of the generation who have been described as “Internet natives” resonate with the plea of teenagers through the generations. But what is particularly significant is that they talk of freedom and safety in the same breath whereas we often refer to them only in separate silos – a point to which I will return shortly.

Similarly, in our efforts to achieve safety and security on the Internet there is no “magical Ministerial button” that we can press to neutralise the bad guys. To minimise institutional vulnerabilities you need training, education and awareness,  and to share intelligence and best practice, and to understand each other’s mutual interests.

As departments compete for scarce resources across government James Jones’s final question has resonance too : “Who should have dominion”? It was a theological question and in those terms the Internet changes nothing. But in terms of human governance the response is more mundane.  Should we have a single Minister to take a grip on Cyber Security? Should the Internet be the purview of one government department or Agency?   Aren't we vulnerable when policy is fragmented across the agencies of Government, Law Enforcement and Security?

Well, we certainly need leadership but it's a myth to think that more gets done just because you have one person in charge.  That myth led to successive governments, from Margaret Thatcher's time onwards, appointing a series of so-called Czars to “take a grip” on policy areas from drugs to farming and from health to education. 

That approach can only work if there is a simple solution to the problem and all that is needed is for heads to be banged together .......   or if the individual is a team worker rather than a demagogue.

Arguably safety on the Internet is the most complex issue we have ever faced.  There are threats to the integrity of the Internet itself, to the security of big companies, banks and governments, to the vulnerabilities of systems from power distribution to manufacturing and to medicine, which all increasingly depend on sophisticated communications. 

The challenges range from sophisticated attacks by crooks who work as a team and treat the Internet like a market place to the security of individual data right down to the spam and phishing attacks which cause such widespread irritation.

So we can just ignore the bottom end of all that .............. Can’t we ? 

Well, no - again, that's a mistake. 

I've been really impressed by the fact that those who know most about the way in which serious crooks and terrorists exploit the Internet are the quickest to understand the connection between what might appear to be low level nuisance activity and the serious threats to society with which they are primarily engaged. Other speakers today have shown just that understanding.

Again, it's no different in the physical world.  Serious crime gets the big headlines - but the things that undermine public confidence are graffiti and litter and incivility and bad behaviour.  Fear and uncertainty about the security of the Internet are the enemies of digital inclusion. So, given that public confidence is important - in the public space and on the Internet - it's a mistake to think you can just “concentrate on the serious stuff”.

Indeed, the recent attack on Stephen Timms demonstrated the connection between terrorism and organised crime on the one hand and what I would describe as “disorganised or opportunistic crime” on the other.

The attack on Stephen incident shows how a seemingly innocuous activity such as viewing online videos can escalate into violence in the “real world” – in this case with murderous intent.

So how do we make sense of the challenge ?

Well, the Internet reminds me of the old Indian parable of the “Blind Men and the Elephant”.  Each man touches a different part of the animal, so their descriptions of the beast are wildly different. It’s like that with the Internet too. 

And it’s a problem that those who are passionate about “the freedom of the Internet” and “net neutrality” are rarely in the same room as those who are passionate about Intellectual Property and the rewards for creativity, or those for whom security is the real issue. It’s enormously frustrating for those who believe – genuinely – that we are “all in this together”.

To me, wisdom starts when people say

·                 We can achieve more together than we achieve alone.

·                 Or (to be slightly mischievous) “United we stand, divided we fall”.

·                 And then - infinitely more difficult but absolutely essential - “hear my truth, and let me hear your truth”. 

What I'm doing is applying a lifetime's experience as a Co-operator and a community worker to the “people issues” of the Internet. 

Whether you're seeking to cut crime or maintain peace in Northern Ireland or fighting to protect the village green a co-operative approach is harder work, but it delivers more long-lasting solutions.

This is no different from the way that people have behaved through the centuries – but it's a simple fact that an inward-looking approach is even more self-defeating in the Internet Age. 

Let’s emphasise three facts ................

First, Governments alone cannot deliver security to the Internet.   

In December the UN is expected to renew the mandate for the Internet Governance Forum (IGF). The IGF is the collaborative approach that has protected the Internet from the attempts to “manage” it through a UN Agency and normal international bureaucracy. It has the strong support of successive Governments in the UK and the USA, and engagement of MPs across party – and it has Industry support but needs greater engagement by Industry. 

The UK has provided leadership in this field and last week the MPs who attended the 2010 IGF in Vilnius reported back to the Minister, Ed Vaizey, and we were very encouraged by his interest and by his response.

Second, Association and cooperation usually achieve more than regulation and legislation. 

A partnership approach is the vital complement to the high level work on cyber security and the work of the police in tackling Internet-related crime. As we speak, work led by Prof Michael Levy at Cardiff University is scoping the way forward on a partnership approach to crime reduction and it’s an important part of the Internet security geography.

 

And we should also take note of another wise saying…. “Laws rarely prevent what they forbid” (Gibbon – Decline & Fall)

 

So from the pub to Parliament, there is tendency to legislate against things we don’t like - the cry is “There ought to be a law against it !” - but there are four questions which should be addressed to any legislator in any circumstances whatsoever :

-              Will this make things better?

-              Will it change people’s behaviour?

-              Will it make people safer?

-              Will it do no harm ................

Usually the answer to all four questions is “no!” but the temptation to legislation is powerful and difficult for officials in Whitehall to resist. And if there is to be legislation, it must be good legislation. 

For example I’m proud of the Gangmasters Act for which I had Ministerial responsibility because it doesn’t put a burden on the good guys – but it does make it possible to come down fast on the bad guys who are exploiting human misery. So it isn’t unfriendly to businesses doing a legitimate job.

Third, the fact is that no one Minister and no one Department can do it all - although coordination is necessary. 

I thought that things were starting to come right when the Digital Britain Report brought the ragged ends together in a single strategy and when Lord West became the Lead Minister on cybercrime and security, working across departments rather than trapped in just one. 

I'm encouraged to see that Ministers in the new government are investing in Cyber Security even at a time of swingeing cuts.

I am also encouraged by the fact that several Ministers seem to be looking beyond traditional models of governance.

The fact is that everyone now depends on the Internet directly and indirectly - so that even those who have never gone online depend on its effectiveness and security. 

And absolutely every government department and agency depends on it too. So do every sector of business and of “Civil Society”.

What that means is that every Minister and every Department and every agency right across Government needs to be working with its own sector or sectors, both to make the most of the opportunities provided by the Internet and to look at ways of making it safe and secure. 

Of course the security services and the police have to continually lift their game in their own areas of activity.  But at the end of the day it's also a challenge for every part of industry, every public sector body and for every individual. It’s not just a matter for law enforcement.

 That's true in respect of the fight to cut crime in your local community or town or city - and it's the partnership approach that has brought down crime in recent years.

Indeed, local projects like the Violence Reduction initiative led by Professor Jon Shepherd in Cardiff demonstrated the importance of implementing a clinical and strategic methodology to crime reduction, analysing incidents of violence and taking account of causal relationships and behaviour patterns. 

Applying this approach in Cardiff we cut the numbers going into A&E for treatment as the result of a violent incident by more than 40%.  That statistic is more real and significant than numbers of arrests or prosecutions.

It’s vitally important because – as others have said – it’s obvious that we should try to stop crime happening in the first place rather than just chasing criminals after the event. And I was pleased to hear the Police Minister, Nick Herbert, quote the words of Sir Robert Peel in asserting that the central role of the police is to prevent offending.

This makes the behaviour of individuals and organisations the absolute key, as always - but yet again it's the speed and the reach and the extraordinary versatility of the Internet that makes what is clear but difficult in the off-line world blindingly obvious and absolutely essential in the online world. 

We need to understand the technology and how people use the technology but ...........

“It’s the People, stupid”

-              as Bill Clinton might have said ............... but probably didn’t !

 

Edmund Burke said this : “When bad men combine, the good must associate”. I’m not usually one to quote a prominent Conservative ideologue  – but on this point he is right absolutely right.  In that context, I’m particularly pleased to hear speakers today referring to the importance of Getsafeonline.

 

Given the ever increasing determination, resources, and sophistication of modern cyber criminals - the only chance we have to prevail is by grasping every opportunity to adopt a collaborative and cooperative approach to the regulation and governance of the internet.

 

If our generation fails to develop a successful Industry-led approach to Internet Safety we will be back to a traditional diet of legislation, regulation and bureaucracy – and a unique opportunity will have been missed.

(Author: Alun Michael MP)

See feedback for this article

---